Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Isolation Accounts Publication Disk Human' = 'C:\bftiydrpaqbub\lsyldntzuwduc.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\AutoConfig Framework Launcher Endpoint] 'ImagePath' = 'C:\bftiydrpaqbub\lsyldntzuwduc.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\AutoConfig Framework Launcher Endpoint] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- 'C:\bftiydrpaqbub\hu1atilvk88.exe' "c:\bftiydrpaqbub\lsyldntzuwduc.exe"
- 'C:\bftiydrpaqbub\lsyldntzuwduc.exe'
- 'C:\bftiydrpaqbub\lzpmpjk2lnypqyoluen.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\bftiydrpaqbub\lsyldntzuwduc.exe
- C:\bftiydrpaqbub\hu1atilvk88.exe
- C:\bftiydrpaqbub\oftyucsxnn
- %WINDIR%\bftiydrpaqbub\v1sryniiwnu
- C:\bftiydrpaqbub\v1sryniiwnu
- C:\bftiydrpaqbub\lzpmpjk2lnypqyoluen.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\bftiydrpaqbub\hu1atilvk88.exe
- C:\bftiydrpaqbub\lsyldntzuwduc.exe
Удаляет следующие файлы:
- C:\bftiydrpaqbub\lzpmpjk2lnypqyoluen.exe
- %WINDIR%\bftiydrpaqbub\v1sryniiwnu
Подменяет следующие файлы:
- %WINDIR%\bftiydrpaqbub\v1sryniiwnu
Сетевая активность:
Подключается к:
- 'pr#####lagranville.net':80
- 'un###lgrain.org':80
- 'ka#####rarowbottom.net':80
- 'ma#####angranville.net':80
- 'gu##155.cn':80
- 'pr####anabolikov.ru':80
- 'ga#####yundongyuan.cn':80
- 'ag#####anabolics.com':80
- 'ha####nhalflion.net':80
- 'ka#####racarpenter.net':80
- 'la#####iagranville.net':80
- 'pr#####larupertson.net':80
- 'de#####stcarpenter.ru':80
- 'al#####riabertrand.net':80
- 'ma#####anrupertson.ru':80
- 'ch#####tacarpenter.net':80
- 'ch#####tarowbottom.net':80
- 'ma#####anrupertson.net':80
- 'ka#####racarpenter.ru':80
- 'ta#####pielenreiten.org':80
- 'gr###factory.cn':80
- 'bu####rmansion.com':80
- 'do##bate.cn':80
- 'cl#####ortswomen.com':80
- 'na##top.ru':80
- 'si###ypeas.net':80
- 'ye####gdongwu.cn':80
- 'sc#####epuzzlechess.org':80
- 'to###tosales.ru':80
- 'ga####liongrass.net':80
- 'so####ryducks.com':80
- 'ka#######ayajivayapriroda.ru':80
- 'pr##card.ru':80
- 'ch####isportsmen.ru':80
- 'sc####ainbow.net':80
- 'sp##tnav.ru':80
- 'pi##asia.cn':80
- 'ca#####eeitinthecup.org':80
- 'cl####portsmen.com':80
TCP:
Запросы HTTP GET:
- http://pr#####lagranville.net/index.php
- http://un###lgrain.org/index.php
- http://ka#####rarowbottom.net/index.php
- http://ma#####angranville.net/index.php
- http://gu##155.cn/index.php
- http://pr####anabolikov.ru/index.php
- http://ga#####yundongyuan.cn/index.php
- http://ag#####anabolics.com/index.php
- http://ha####nhalflion.net/index.php
- http://ka#####racarpenter.net/index.php
- http://la#####iagranville.net/index.php
- http://pr#####larupertson.net/index.php
- http://de#####stcarpenter.ru/index.php
- http://al#####riabertrand.net/index.php
- http://ma#####anrupertson.ru/index.php
- http://ch#####tacarpenter.net/index.php
- http://ch#####tarowbottom.net/index.php
- http://ma#####anrupertson.net/index.php
- http://ka#####racarpenter.ru/index.php
- http://ta#####pielenreiten.org/index.php
- http://gr###factory.cn/index.php
- http://bu####rmansion.com/index.php
- http://do##bate.cn/index.php
- http://cl#####ortswomen.com/index.php
- http://na##top.ru/index.php
- http://si###ypeas.net/index.php
- http://ye####gdongwu.cn/index.php
- http://sc#####epuzzlechess.org/index.php
- http://to###tosales.ru/index.php
- http://ga####liongrass.net/index.php
- http://so####ryducks.com/index.php
- http://ka#######ayajivayapriroda.ru/index.php
- http://pr##card.ru/index.php
- http://ch####isportsmen.ru/index.php
- http://sc####ainbow.net/index.php
- http://sp##tnav.ru/index.php
- http://pi##asia.cn/index.php
- http://ca#####eeitinthecup.org/index.php
- http://cl####portsmen.com/index.php
UDP:
- DNS ASK ch#####belelisabeth.net
- DNS ASK re#####nnegloriana.net
- DNS ASK ch#####belgloriana.net
- DNS ASK ch#####belcheyanne.net
- DNS ASK ch#####belcheyanne.ru
- DNS ASK re#####nneelisabeth.net
- DNS ASK re#####nneeglantine.net
- DNS ASK ki#####eighcheyanne.net
- DNS ASK be#####tteelisabeth.net
- DNS ASK ki######ighelisabeth.net
- DNS ASK re#####nneeglantine.ru
- DNS ASK ch#####beleglantine.net
- DNS ASK be#####ttecheyanne.net
- DNS ASK re#####nnecheyanne.net
- DNS ASK ch#####anneeglantine.ru
- DNS ASK ja#####inecheyanne.net
- DNS ASK ge#####nnacheyanne.net
- DNS ASK ma#####ttaeglantine.net
- DNS ASK ch#####annegloriana.net
- DNS ASK ch######nneeglantine.net
- DNS ASK ja#####ineelisabeth.net
- DNS ASK ge#####nnagloriana.net
- DNS ASK ja#####ineeglantine.net
- DNS ASK ge#####nnaeglantine.net
- DNS ASK ge#####nnaelisabeth.net
- DNS ASK ja#####inegloriana.net
- DNS ASK ja#####inegloriana.ru
- DNS ASK ki#####eighelisabeth.ru
- DNS ASK er#####udephilander.ru
- DNS ASK al#####reaphilander.net
- DNS ASK er#####udefrederica.net
- DNS ASK er#####udebertrand.net
- DNS ASK al#####reabertrand.net
- DNS ASK er#####udephilander.net
- DNS ASK al#####reafrederica.net
- DNS ASK mo#####erybertrand.net
- DNS ASK mo#####eryphilander.net
- DNS ASK mo#####eryfrederica.net
- DNS ASK er#####udepleasance.net
- DNS ASK al#####reapleasance.net
- DNS ASK al#####reapleasance.ru
- DNS ASK al#####riaeglantine.net
- DNS ASK ki######igheglantine.net
- DNS ASK al#####riacheyanne.net
- DNS ASK al#####riacheyanne.ru
- DNS ASK be#####ttegloriana.net
- DNS ASK ki#####eighgloriana.net
- DNS ASK be#####tteeglantine.net
- DNS ASK ch######ellecheyanne.net
- DNS ASK ch######ellegloriana.net
- DNS ASK ch#####bellegloriana.ru
- DNS ASK ch######elleeglantine.net
- DNS ASK al#####riaelisabeth.net
- DNS ASK ch######elleelisabeth.net
- DNS ASK al#####riagloriana.net
- DNS ASK al######iaswindlehurst.net
- DNS ASK ch#######lleswindlehurst.net
- DNS ASK al######iabloodworth.net
- DNS ASK ki#######ghchristopherson.ru
- DNS ASK al######iaabrahamson.net
- DNS ASK ch######elleabrahamson.net
- DNS ASK al#####riabloodworth.ru
- DNS ASK er#####udecheyanne.net
- DNS ASK al#####reacheyanne.net
- DNS ASK al#####reacheyanne.ru
- DNS ASK ch######ellebloodworth.net
- DNS ASK al#######achristopherson.net
- DNS ASK ch#######llechristopherson.net
- DNS ASK ki#######ghchristopherson.net
- DNS ASK re#######echristopherson.net
- DNS ASK ch#######lchristopherson.net
- DNS ASK be######teabrahamson.net
- DNS ASK re######nebloodworth.net
- DNS ASK ch######elbloodworth.net
- DNS ASK ch#####belbloodworth.ru
- DNS ASK ki######ighabrahamson.net
- DNS ASK be######tebloodworth.net
- DNS ASK ki######ighbloodworth.net
- DNS ASK be#######echristopherson.net
- DNS ASK be######teswindlehurst.net
- DNS ASK be######teswindlehurst.ru
- DNS ASK ki######ighswindlehurst.net
- DNS ASK er#####udeelisabeth.net
- DNS ASK ch#####phergloriana.net
- DNS ASK ch#####phergloriana.ru
- DNS ASK te#####nceeglantine.net
- DNS ASK te#####nceelisabeth.net
- DNS ASK ch######herelisabeth.net
- DNS ASK te#####ncegloriana.net
- DNS ASK ch######hereglantine.net
- DNS ASK ma#####ttaelisabeth.ru
- DNS ASK ch######nneelisabeth.net
- DNS ASK ma#####ttagloriana.net
- DNS ASK ma#####ttacheyanne.net
- DNS ASK ch#####annecheyanne.net
- DNS ASK ma#####ttaelisabeth.net
- DNS ASK ch#####phercheyanne.net
- DNS ASK er#####udeeglantine.net
- DNS ASK er#####udeeglantine.ru
- DNS ASK al#####reaeglantine.net
- DNS ASK al#####reaelisabeth.net
- DNS ASK er#####udegloriana.net
- DNS ASK al#####reagloriana.net
- DNS ASK mo#####erycheyanne.net
- DNS ASK mo#####eryeglantine.net
- DNS ASK te#####ncecheyanne.net
- DNS ASK te#####ncecheyanne.ru
- DNS ASK mo#####eryelisabeth.net
- DNS ASK ch#####belelisabeth.ru
- DNS ASK mo#####erygloriana.net
- DNS ASK al#####riabertrand.net
- DNS ASK la#####iagranville.net
- DNS ASK pr#####larupertson.net
- DNS ASK be#####ttefrederica.ru
- DNS ASK al#####riapleasance.ru
- DNS ASK de#####stcarpenter.ru
- DNS ASK ma#####anrupertson.ru
- DNS ASK ch#####tarowbottom.net
- DNS ASK ka#####racarpenter.net
- DNS ASK ka#####rarowbottom.net
- DNS ASK ma#####anrupertson.net
- DNS ASK ka#####racarpenter.ru
- DNS ASK ch#####tacarpenter.net
- DNS ASK la#####iarupertson.net
- DNS ASK de#####strupertson.net
- DNS ASK be#####ttephilander.net
- DNS ASK pr#####larowbottom.net
- DNS ASK de#####stgranville.net
- DNS ASK ki######ighpleasance.net
- DNS ASK al#####riaphilander.net
- DNS ASK ma#####ancarpenter.net
- DNS ASK pr#####larowbottom.ru
- DNS ASK pr#####lacarpenter.net
- DNS ASK ma#####anrowbottom.net
- DNS ASK al#####riapleasance.net
- DNS ASK ki######ighfrederica.net
- DNS ASK ki######ighphilander.net
- DNS ASK ma#####angranville.net
- DNS ASK ga####liongrass.net
- DNS ASK do##bate.cn
- DNS ASK cl#####ortswomen.com
- DNS ASK cl####portsmen.com
- DNS ASK sp##tnav.ru
- DNS ASK pi##asia.cn
- DNS ASK gr###factory.cn
- DNS ASK to###tosales.ru
- DNS ASK si###ypeas.net
- DNS ASK ye####gdongwu.cn
- DNS ASK bu####rmansion.com
- DNS ASK na##top.ru
- DNS ASK sc#####epuzzlechess.org
- DNS ASK ca#####eeitinthecup.org
- DNS ASK ag#####anabolics.com
- DNS ASK ha####nhalflion.net
- DNS ASK pr####anabolikov.ru
- DNS ASK pr#####lagranville.net
- DNS ASK un###lgrain.org
- DNS ASK gu##155.cn
- DNS ASK ga#####yundongyuan.cn
- DNS ASK so####ryducks.com
- DNS ASK ka#######ayajivayapriroda.ru
- DNS ASK sc####ainbow.net
- DNS ASK ta#####pielenreiten.org
- DNS ASK pr##card.ru
- DNS ASK ch####isportsmen.ru
- DNS ASK ma#####ttafrederica.net
- DNS ASK ch######nnefrederica.net
- DNS ASK ma#####ttapleasance.net
- DNS ASK ma#####ttaphilander.net
- DNS ASK ch######nnephilander.net
- DNS ASK ch#####annephilander.ru
- DNS ASK ch######nnepleasance.net
- DNS ASK ja#####inephilander.net
- DNS ASK ge#####nnaphilander.net
- DNS ASK ja#####inefrederica.net
- DNS ASK ja#####inebertrand.ru
- DNS ASK ja#####inebertrand.net
- DNS ASK ge#####nnabertrand.net
- DNS ASK ch#####annebertrand.net
- DNS ASK ch#####pherbertrand.net
- DNS ASK ch#####pherbertrand.ru
- DNS ASK te#####ncephilander.net
- DNS ASK mo#####eryfrederica.ru
- DNS ASK mo#####erypleasance.net
- DNS ASK te#####ncebertrand.net
- DNS ASK ch######herphilander.net
- DNS ASK te#####ncepleasance.ru
- DNS ASK ch######herpleasance.net
- DNS ASK ma#####ttabertrand.net
- DNS ASK te#####ncefrederica.net
- DNS ASK ch######herfrederica.net
- DNS ASK te#####ncepleasance.net
- DNS ASK ge#####nnafrederica.net
- DNS ASK ch######ellephilander.net
- DNS ASK al#####riafrederica.net
- DNS ASK ch######ellepleasance.net
- DNS ASK ch######ellefrederica.net
- DNS ASK de#####stcarpenter.net
- DNS ASK ki#####eighbertrand.net
- DNS ASK la#####iacarpenter.net
- DNS ASK ch######ellebertrand.net
- DNS ASK la#####iarowbottom.net
- DNS ASK de#####strowbottom.net
- DNS ASK be#####ttefrederica.net
- DNS ASK be#####ttepleasance.net
- DNS ASK ch#####bellebertrand.ru
- DNS ASK be#####ttebertrand.net
- DNS ASK re#####nnebertrand.net
- DNS ASK ch#####belbertrand.net
- DNS ASK re#####nnephilander.net
- DNS ASK ge#####nnafrederica.ru
- DNS ASK ja#####inepleasance.net
- DNS ASK ge#####nnapleasance.net
- DNS ASK re#####nnephilander.ru
- DNS ASK re#####nnepleasance.net
- DNS ASK ch#####belpleasance.net
- DNS ASK ch#####belpleasance.ru
- DNS ASK ch#####belphilander.net
- DNS ASK re#####nnefrederica.net
- DNS ASK ch#####belfrederica.net
